nylas-webhooks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). Outsider-authored free text (the Nylas webhook GET challenge value / POST JSON payload) is read from inbound HTTP requests and then injected into the handler’s runtime context as plain text/JSON via req.query.challenge (Next.js GET) and await request.body() + JSON.parse (all examples), making it potentially prompt-injectable if later passed to an LLM.